Decryption keys are now freely available for victims of CryptoLocker

• CryptoWall 3.0 Support & Help Topic

Hi All,

New Here.

I know this is an old post but just had a client get hit with Cryptolocker. All files have .cryptolocker extension. Are there any decryption tool available. 

Edited by stacyp72, 09 January 2020 - 10:33 PM.

The original CryptoLocker Ransomware which first appeared in the beginning of September 2013...does not exist anymore and hasn't since June 2014. There are many copycat ransomware variants which pretend to be or use the CryptoLocker name but these infections are not the same.
 
Did you submit (upload) samples of encrypted files, ransom notes and any contact email addresses or hyperlinks provided by the cyber-criminals to ID Ransomware (IDR) OR Emsisoft Identify your ransomware for assistance with identification and confirmation of the infection? Uploading both encrypted files and ransom notes together along with any contact email addresses or hyperlinks provided by the criminals gives a more positive match with identification and helps to avoid false detections.

Emisisoft ID's it as RAPID but the files have the .cryptolocker extension. and not the .rapid.

Edited by stacyp72, 10 January 2020 - 11:52 AM.

Rapid uses different extensions, not just .rapid. ID Ransomware (which powers the Emsisoft identifier) can tell by the filemarker, so it is very accurate. Definitely Rapid.

Thanks for the info. So far Rapid not decryptable correct?

Correct. Only the criminals have the private RSA keys to decrypt your, and everyone else's files. I've personally analyzed several variants of Rapid, and they are all secure. Lots of mistakes in their code, but nothing that compromises the crypto scheme used.

There is an ongoing discussion in this topic where victims can post comments, ask questions and seek further assistance. Other victims have been directed there to share information, experiences and suggestions.

• Rapid Ransomware (.rapid, .paymeme - ! How Recovery Files.txt) Support Topic